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Abstract. In this work the arbitrarily varying wiretap channel AVWC 
is studied. We derive a lower bound on the random code secrecy capac- 
ity for the average error criterion and the strong secrecy criterion in the 
case of a best channel to the eavesdropper by using Ahlswede's robus- 
tification technique for ordinary AVCs. We show that in the case of a 
non-symmetrisable channel to the legitimate receiver the deterministic 
code secrecy capacity equals the random code secrecy capacity, a result 
similar to Ahlswede's dichotomy result for ordinary AVCs. Using this we 
can derive that the lower bound is also valid for the deterministic code 
capacity of the AVWC. The proof of the dichotomy result is based on 
the elimination technique introduced by Ahlswede for ordinary AVCs. 
We further prove upper bounds on the deterministic code secrecy ca- 
pacity in the general case, which results in a multi-letter expression for 
the secrecy capacity in the case of a best channel to the eavesdropper. 
Using techniques of Ahlswede, developed to guarantee the validity of a 
reliability criterion, the main contribution of this work is to integrate the 
strong secrecy criterion into these techniques. 

1 Introduction 

Models of communication systems taking into account both the requirement 
of security against a potential eavesdropper and reliable information transmis- 
sion to legitimate receivers which suffer from channel uncertainty, have received 
much interest in current research. One of the simplest communication models 
with channel uncertainty are compound channels, where the channel realisation 
remains fixed during the whole transmission of a codeword. Compound wiretap 
channels were the topic of previous work of the authors [7] , [8] and for example 
of [T3], [S]. In the model of an arbitrarily varying wiretap channel AVWC the 
channel state to both the legitimate receiver and the eavesdropper varies from 
symbol to symbol in an unknown and arbitrary manner. Thus apart from eaves- 
dropping the model takes into account an active adversarial jamming situation in 
which the jammer chooses the states at her/his will. Then reliable transmission 
to the legitimate receiver must be guaranteed in the presence of the jammer. 



In this paper we consider families of pairs of channels 2H = {(W s ™ ,V S ™) : 
s n E S n } with common input alphabets and possibly different output alpha- 
bets, where s n £ S n denotes the state sequence during the transmission of a 
codeword. The legitimate users are connected via W s n and the eavesdropper 
observes the output of V s n . In our communication scenario the legitimate users 
have no channel state information. We derive capacity results for the AVWC 
2XT under the average error probability criterion and a strong secrecy criterion. 
The investigation of the corresponding problem concerning the maximum error 
criterion is left as a subject of future investigations. However, we should em- 
phasize that there is no full capacity result for an ordinary (i.e. without secrecy 
constraints) AVC for the maximum error criterion. Together with Wolfowitz in 
[5] Ahlswede determined the capacity for AVCs with binary output alphabets 
under this criterion. In [I] he showed that the general solution is connected to 
Shannon's zero error capacity problem [15] . 

Two fundamental techniques, called elimination and robustification technique 
discovered by Ahlswede will play a crucial role in this paper. In [5] he developed 
the elimination technique to derive the deterministic code capacity for AVCs 
under the average error probability criterion, which is either zero or equals its 
random code capacity, a result, which is called Ahlswede's dichotomy for sin- 
gle user AVCs. With the so-called robustification technique [5] in turn he could 
link random codes for the AVC to deterministic codes for compound channels. 
Further in the papers [3J, [I] on common randomness in information theory 
Ahlswede together with Csiszar studied, inter alia, problems of information the- 
oretic security by considering a model which enables secret sharing of a random 
key, in particular in the presence of a wiretapper. Because the arbitrarily varying 
wiretap channel AVWC combines both the wiretap channel and the AVC it is 
not surprising that we can use the aforementioned techniques to derive capac- 
ity results for the AVWC. The actual challenge of our work was to integrate 
the strong secrecy criterion in both the elimination and the robustification tech- 
nique, approaches, both were developed to guarantee a reliability criterion. As 
it was shown in [8], compared with weaker secrecy criteria, the strong secrecy 
criterion ensures that the average error probability of every decoding strategy 
of the eavesdropper in the limit tends to one. 

In Section [3.21 we give a lower bound on the random code secrecy capacity in 
the special case of a "best" channel to the eavesdropper. The proof is based on the 
robustification technique by Ahlswede [6] combined with results for compound 
wiretap channels given by the authors in [8]. 

In Section [3.31 we use the elimination technique [2], which is composed of the 
random code reduction and the elimination of randomness |10) . to show that, 
provided that the channel to the legitimate receiver is non-symmetrisable, the 
deterministic code secrecy capacity equals the random code secrecy capacity and 
to give a condition when it is greater than zero. Thus we establish a result for the 
AVWC that is similar to that of Ahlswede's dichotomy result for ordinary AVCs. 
As a consequence the above-mentioned lower bound on the random code secrecy 
capacity can be achieved by a deterministic code under the same assumptions. 



In Section 13.41 we give a single- letter upper bound on the deterministic code 
secrecy capacity, which corresponds to the upper bound of the secrecy capacity 
of a compound wiretap channel. Moreover, by establishing an multi-letter upper 
bound on the secrecy capacity we can conclude to a multi-letter expression of 
the secrecy capacity of the AVWC in the special case of a best channel to the 
eavesdropper. 

The lower bound on the secrecy capacity as well as other results were given 
earlier in [14] for a weaker secrecy criterion, but the proof techniques for the 
stronger secrecy criterion differ significantly, especially in the achievability part 
for the random codes. 

2 Arbitrarily Varying Wiretap Channels 
2.1 Definitions 

Let A, B, C be finite sets and consider a non-necessarily finite family of channels 
where s e S denotes the state of the channel. Now, given 
s n = (si, S2, • • • , s n ) 6 S n we define the stochastic matrix 

n n 

W n (y n \x n ,s n ) :=Y[W{jH\xi,8 t ) :=l[W 9t {yi\xi) (1) 

i=i i=i 

for all y n = (y\, . . . , y n ) G B n and x n — (x%, . . . , x n ) <E A n . An arbitrarily vary- 
ing channel is then defined as the sequence {W™}^^ of the family of channels 
W" = {W n (-|-, s n ) : s n S S 71 }. Now let W" represent the communication link to 
a legitimate receiver to which the transmitter wants to send a private message, 
such that a possible second receiver should be kept as ignorant of that message 
as possible. We call this receiver the eavesdropper, which observes the output of 
a second family of channels V™ = {V 7l ( , | , ) s") : s" £ S"} with an analogue defi- 
nition of V n (-\-, s") as in (TTJ for V s : A V(C), s e S. Then we denote the set of 
the two families of channels with common input by 2U = {(W^n, V a n) : s n € S n } 
and call it the arbitrarily varying wiretap channel. In addition, we assume that 
the state sequence s n is unknown to the legitimate receiver, whereas the eaves- 
dropper always knows which channel is in use. 

A (n, J n ) code C n for the arbitrarily varying wiretap channel 2U consists of 
a stochastic encoder E : J n — > V(A n ) (a stochastic matrix) with a message set 
J n := {1, . . . , J n } and a collection of mutually disjoint decoding sets {Dj C B n : 
j € Jn\- The average error probability of a code C n is given by 

1 Jn 

e(C„):= max ^ E{x n \j)W^{D«\x n ) . (2) 

A correlated random (n, J„, J 1 , fi) code C™ for the arbitrarily varying wiretap 
channel is given by a family of wiretap codes {C„(7)} 76 r together with a random 



1 V(B) denotes the set of probability distributions on B. 



experiment choosing 7 according to a distribution /1 on f. The mean average 
error probability of a random (n.J n , T, /i) code C™ n is defined analogously to the 
ordinary one but with respect to the random experiment choosing 7 by 

Jn 

e(CD--= max — £ £ £ E^x n \j)W^((D]r\x n )^) . 

Definition 2.1. j4 non-negative number Rg is an achievable secrecy rate for 
the AVWC 2U, i/ £/iere is a sequence (C„)„gN 0/ (n, J„) codes smc/i that 

lim e(C„) = , 
lim inf — log J„ > i?s , 

and 

lim max I(pj\V£) = , (3) 

n— >oo s™eS™ 

where J is a uniformly distributed random variable taking values in J n and 
I(pj;V*n) is the mutual information of J and the output variable Z n of the 
eavesdropper's channel V s ™ . The secrecy capacity then is given as the supremum 
of all achievable secrecy rates Rs and is denoted by Cs{%0). 

Analogously we define the secrecy rates and the secrecy capacity for random 
codes Cs )ran (23J), if we replace C n by C™ in the above definition. 

Definition 2.2. A non-negative number Rs is an achievable secrecy rate for 
correlated random codes for the AVWC 2B, if there is a sequence (CJj an ) ra gN of 
(n,J n ,r,fj,) codes such that 

lim e(C ) - , 

n— too 

lim inf — log J n > Rs , 

n— too 71 

and 

lim max £ I( PJ , V? n ; C( 7 ))/*(7) = , (4) 

where I(p,j, V£k ; £(7)) is £/ie mutual information according to the code Cry), 7 S 
I 1 chosen according to the distribution \x. The secrecy capacity then is given as 
the supremum of all achievable secrecy rates Rs and is denoted by Cs iran (2JJ) • 



3 Capacity Results 
3.1 Preliminaries 

In what follows we use the notation as well as some properties of typical and 
conditionally typical sequences from [10]. For p £ V(A) 7 W : A — » V(B), x n £ 



A n , and S > we denote by T™ s the set of typical sequences and by T^ s (x n ) 
the set of conditionally typical sequences given x n in the sense of |10) . 
The basic properties of these sets that are needed in the sequel are summarised 
in the following three lemmata. 

Lemma 3.1. Fixing S > 0, for every p £ V(A) and W : A — >• V(B) we have 

P® n {T p n tS ) > 1 - (n+ \)\ A \2- ncS2 
W® n {7% >s {x n )\x n ) > 1 - (n+ i)l^ll B l2-™ c52 

for all x n £ A n with c — 1/(2 In 2). In particular, there is uq £ N such that for 
each S > and p e V(A), W : A -> V(B) 

p® n {T;] s ) > i - 2- nc ' s2 

W® n (T& >s (x n )\x n ) > 1 - 2-' nc ' s2 

holds with d = §. 

Proof. Standard Bernstein-Sanov trick using the properties of types from [10] 
and Pinsker's inequality. The details can be found in [16] and references therein 
for example. □ 

Recall that for p £ V{A) and W : A -)• pVF £ denotes the output 

distribution generated by p and W and that x n £ T™ s and y™ £ 7^,5(2;") imply 
that y n £ 7^^. 

Lemma 3.2. Let x n £ T£ s> then for V : A -> 7>(C) 

IVv,3|A|*l < 
V^(« n |a? n ) < /3 /or all z n £ T^ s (x n ) 

hold, where 

= 2 -n{H(V\p)-h{5)) ^ 

with universal fi(S), f%{S) > satisfying lim^oo fi(S) = = lim^oo f2(5). 

Proof, cf. ing. 

The next lemma is a standard result from large deviation theory. 

Lemma 3.3. ( Chernoff bounds) Let Z%, ■ ■ ■ , Zl be i.i.d. random variables with 
values in [0, 1] and expectation ¥<Zi = fj,, and < e < i. Then it follows that 

*v{~X>£[(l±e)/i]j <2exp (-L-^ 
where [(1 ± e)/j] denotes the interval [(1 — e)/i, (1 + e)/x]. 



For the optimal random coding strategy of the AVWC we need the robustification 
technique by Ahlswede [6 which is formulated as a further lemma. Therefore let 
S n be the group of permutations acting on (1, 2, . . . , n). Then every permutation 
a G S n induces a bijection tt G 77„ defined by tt : S n — > S n with 7r(s n ) = 
(s CT (i), . . . , s cr („)) for all s" = (si,...,s„) G S n and 7T„ denotes the group of 
these bijections. 

Lemma 3.4. (Robustification technique) If a function f : S n — > [0, 1] satisfies 
J2 •...•<?(*„)> 1-7 (7) 

for all q G Vo(n,S) and some 7 G [0, 1], then 

^ E /^( s ")) > 1 - 3 • (n + I)' 5 -7 Vs" G 5" . (8) 
Proof. The proof is given in [6]. 

To reduce the random code for the AVWC W to a deterministic code we need 
the concept of symmetrisability, which was established for ordinary AVCs in the 
following representation by [12] , [11] . 

Definition 3.5. Ulf An AVC is symmetrisable if for some channel U : A — > S 

W(y\x, s)U(s\x') = W(y\x', s)U(s\x) (9) 
ses ses 

for all x,x' G A, y G B. 

A new channel defined by ((9]) then would be symmetric with respect to all 
x, x 1 G A. The authors of [IT] proved the following theorem which is a con- 
cretion of Ahlswede's dichotomy result for single-user AVC, which states that 
the deterministic code capacity C is either C — or equals the random code 
capacity. 

Theorem 3.6. \1 If C > if and only if the AVC is non- symmetrisable. If 
C > 0, then 

C = max min I(p, W) (10) 

pev(A) wew 

Here the RHS gives the random code capacity and W denotes the convex closure 
of all channels W s with s G S, S finite or countable. 

3.2 Random Code Construction 

First let us define the convex hull of the set of channels {W s : s G S} by the set 
of channels {W q : q G V(S)}, where W q is defined by 

W q (y\x) = J2w(y\x,s)q(s), (11) 

ses 



for all possible distributions q G V(S). Accordingly we define V q and its convex 
hull {V q : q G V(S)}. Then we denote the convex closure of the set of channels 
{(W S ,V S ) : s G S} by W := {(W q ,V q ) : q G V(S),S C S, S is finite}. Occa- 
sionally, we restrict q to be from the set of all types Vo{n, S) of state sequences 
s" G S n . 

Lemma 3.7. The secrecy capacity Cs(2U) of the arbitrarily varying wiretap 
channel AVWC 2U equals the secrecy capacity of the arbitrarily varying wire- 
tap channel 2U. 

Proof. The proof was given for an ordinary arbitrarily varying channel AVC 
without secrecy criterion in |10j and for an AVWC under the weak secrecy cri- 
terion in [14. Let W%, . . . ,W n be averaged channels as defined in (ITT1) and a 
channel W? : A n ->• V{B n ) with q = U"=i ft, 3 G V(S n ), q t G V{S) defined by 

n n 

W?(y n \x n ) =Y[Wi(yi\xi) =Y[W qi ( yi \xi) = E W n (y n \x n ,s n )q(s n ) 

i=l i=l s"gS™ 

If we now use the same (n, J n ) code C n defined by the same pair of encoder and 
decoding sets as for the AVWC 2U the error probability for transmission of a 
single codeword by the channel W~ is given by 

E E(x n \j)W?(D]\x n )= E a(* n ) E E(x n \j)W»(D'.\x n ) 
and we can bound the average error probability by 

1 Jn 

7 EE E(x n \j)W?(D*\x n ) 
i £2 

Otherwise, because 2U is a subset of 2U , which is the closure of the set of chan- 
nels (W~", V~ l ), the opposite inequality holds for the channel W 7 - 1 that maximizes 
the error probability. Because V- 1 is defined analogously to W-", we can define 
for the (n, J n ) code 

V(z n \j):= E E(x n \j)V?(z»\x n ) (12) 

for all z n G C n , j G J n . Then 

V(z n \j) = E E E(x n \j)V s n n (z n \x n ) = E ?(OV?»(* n li) (13) 



and because of the convexity of the mutual information in the channel V and 
(fT3"|) it holds that 



z$) < v(s n )i(J; z? n ) < sup z s "„). (14) 

s"6S™ S " 

Now because {V^{z n \j) : s n G S n } is a subset of {V{z n \j) : q G T(S n )} we end 
in 

sup I(J, Z5) = sup I (J, Z™ ) . 

□ 

Now we can proceed in the construction of the random code of the AVWC 20. 

Definition 3.8. We call a channel to the eavesdropper a best channel if there 
exist a channel V q * G {V q : q G T'(S)} such that all other channels from {V q : 
q G V(S)} are degraded versions of V q * . If we denote the output of any channel 
V q , q G V(S) by Z q it holds that 

X -> Z q , -> Z q , Vq G V(S). (15) 

Proposition 3.9. Provided that there exist a best channel to the eavesdropper, 
for the random code secrecy capacity Cs,ran(%B) of the AVWC 2U it holds that 

C s ,ran(28)> max ( min I(p,W q ) - max I(p,V q )). (16) 

Proof. The proof is based on Ahlswedes robustification technique [6 and is di- 
vided in two parts: 
step 1 ): The set 

W:={(W;\V^):qeP(S)} 

corresponds to a compound wiretap channel indexed by the set of all possible 
distributions q G V(S) on the set of states S. First we show, that there exist a 
deterministic code for the compound wiretap channel W that achieves the lower 
bound on the random code secrecy capacity of the AVWC 2U given in l|16p. 

In [8] it was shown that for a compound wiretap channel {(Wt, Vt) : t G 9} 
without channel state information at the legitimate receivers the secrecy capacity 
is bounded from below by 

Cs.comp > max (min I(p, W s ) - max/(p, V s )). (17) 
pev(A) tee tee 

In accordance with the proof of (|17l) in [5] we define a set of i.i.d. random 
variables {Xji}j e [j n ]j e [L n ] each according to the distribution p' G V(A n ) with 

p\x n ) := I p»"(7^ 4 ) x fe (18) 
I otherwise, 



for any p G V{A), and where J n and L n are chosen as 

L n = L2" [sup i^(s) / (P^<!)+T]j (20) 

with t > 0. Now we assume that there exist a best channel to the eavesdropper 
V g * in contrast to the proof in [5]. Hence by the definition of V q * in (|T5|) and 
because the mutual Information /(p, 1/) is convex in V and every member of 
{Vq}q£V(S) i s a convex combination of the set {Vs} s6 s, it holds that 

I(P,V q .) =supI(p,V s ) = sup I(p,V g ) (-oil 
s qev(s) v y 

for all p G V(A). Note that because of (H]) for \S\ < oo V r G {V s : s G 5}, 
which means that g* is a one-point distribution. 

By the definition of the compound channel W the channels to the eavesdrop- 
per are of the form 

n 

V»(*"|z n ):=n^(*M (22) 
i=i 

for all q G 'P(S). Then following the same approach as in the proof in [5] we 
define 

Q q Mz n ) = V q n (z n \x n )-l r ^ s(xn) (z n ), 

and 

^(* n ) = E PV l )<2^"(^). (23) 

for all z n G C". Now let 23 := {z" G C" : 6>^(z") > ea q } where e = 2^" c ' <52 (cf. 
Lemma [3.1|) and a q is from ([5]) in Lemma 13.21 computed with respect top and V q . 
By Lemma I3~2l the support of Q' q has cardinality < a^ 1 since for each x n G 7^ 
it holds that T^ 5 (x n ) C 7^- 2 , A , 5 , which implies that £ z „ eB 6) ?( z ") > 1 ~ 2e, 
if 

= ©;(z") • l B (z n ) and 

Q ? ,X«(^)=Q g ,xn(^)-lB(^)- (24) 



Now it is obvious from ([23)1 and the definition of the set B that for any z n G B 
O q (z n ) = 'KQq^Xji (z n ) > ea 9 if E is the expectation value with respect to the 
distribution p' . Let f5 q defined as in © with respect to V q . For the random 
variables (3~ 1 Q q _x jl {z n ) define the event 

f| \^-Y,Q q ,x Jl (z n )e[(l±e)0 q (z n )}\, (25) 
*™ e c» l^" 1=1 J 

and keeping in mind that O q (z n ) > ea q for all z n G £>. Then it follows that for 
all j G [ J n ] and for all s G S 

Pr{M<z)) c } < 2\C\ n exp ( - L n ) (26) 



by Lemma 13.31 Lemma 13.21 and our choice e = 2- nc ' s with g{§) := f x (8) + 
f2(8) + 3c' 5 2 . Making 5 > sufficiently small we have for all sufficiently large 
n e N 

£ 2- n [ I (p> v i)+9(s)] > 2 n i _ 



Thus, for this choice of S the RHS of (|26)) is double exponential in n uniformly in 
q £ 'P(S') and can be made smaller than e J" 1 for all j £ [J n ] and all sufficiently 
large neN. I.e. 

Pr{(^)) c } < eJ- 1 V ? eP(S) (27) 

Now we will show that we can achieve reliable transmission to the legitimate 
receiver governed by {(W™ : q £ V(S)} for all messages j £ [J n ] when ran- 
domising over the index I £ L n but without the need of decoding I £ [L n ]. To 
this end define X = {^j/}je[j„],/(E[L„] to be the set of random variables with 
Xji are i.i.d. according to p' defined in (TT5|) . Define now the random decoder 
{Dj(X)}j e ij n ] Q B n analogously as in [5], [7]. Then it was shown by the au- 
thors, that there exist a sequence of (n, J n ) codes for the compound wiretap 
channel in the particular case without CSI with arbitrarily small mean average 
error 

E X {\${X)) < 2- na 

for all q £ V(S) and sufficiently large n £ N. Additionally we define for each 
q G V{S) 

L (q) = {\W(X))<2- n %} (28) 

and set 

f) f\ h (q) (29) 

9 e-Po(n,S)i=0 

Then with (|27|) . f|28[) and applying the union bound we obtain 

Pr{t c } < 2- nc 

for a suitable positive constant c > and all sufficiently large n £ N (Cf. [5]). 
Hence, we have shown that there exist realisations {xji} of {A™ ; } j e[j n ],ie[L n ] such 
that Xji £ l for all j £ [ J„] and Z £ [L n ] . Now following the same argumentation 
as in [8], [7] we obtain that there is a sequence of (n,J n ) codes that for all 
codewords {xji} it follows by construction that 

lErE w?(^ c m < ^ na ' (30) 



is fulfilled for n £ N sufficiently large and for all q £ 'P(S') with a' > 0. So we 
have found a (n, </„) code with average error probability upper bounded by (I30[) . 
Further, for the given code and a random variable J uniformly distributed on 
the message set { 1 , . . . , J n } it holds that 



I(pj;V q n )<e' 



(31) 



uniformly in q 6 V(S). Both (|3U)) and (|3~T|) ensure that in the scenario of the 
compound wiretap channel W the legitimate receiver can identify each message 
j from the message set { 1 , . . . , J n } with high probability, while at the same 
time the eavesdropper receives almost no information about it. That is, that all 
numbers Rs with 

R s < inf I(p,W g )- sup I(p,V q ) (32) 
qev(s) 

are achievable secrecy rates of the compound wiretap channel W. 
step 2 ): Robustification : In the second step we derive from the deterministic 
(n, J n ) code for the above mentioned compound wiretap channel W a (n, J n ) 
random code C n an for the AVWC 2U, which achieves the same secrecy rates. We 
note first that by flU) and ^ 



max I( PJ , V s n ) = I( PJ , V q n , ) < e', (33) 

which means, that, due to the assumption of a best channel to the eavesdropper, 
the code achieving the secrecy rate for the best channel to the eavesdropper 
fulfills the secrecy criterion for a channel with any state sequence s n £ S n . Now, 
as already mentioned we use the robustification technique (cf. Lemma I3.4|) to 
derive from the deterministic code Cyy = {xji,Dj : j G [J n ]J G [L n ]} of the 
compound wiretap channel W the random code for the AVWC 2U. Therefore, 
for now let S to be finite. With (|3T)|) it holds that 

j- J2 JT Yl Yl W n {D j \x jl ,s n )q® n (s n )>l-2- na ' (34) 
" jeiJn] n /£[£„] s»es» 

for all q® n — Y\i=i 9 ano - m particular for all q £ Vo(n, S). Now let tt £ 7T n be 
the bijection on S n induced by the permutation a G S n . Since ([7]) is fulfilled 
with 

f(s n ) = Y J2 J-J2 W^D^us") (35) 
Jn i6[J„] ^" te[L n ] 

it follows from ([5]) that 

^ E T- E J- E ^"Pil^,^"))>l-(n+l) |S| 2— ' (36) 



for all s™ G 5". Hence by defining C 71 " := {tt^ 1 (x 1 J [ ), TT~ 1 (Dj)} as a member 
of a family of codes {C^y^^n^ together with a random variable K distributed 
according to /i as the uniform distribution on 7T n , (|36p is equivalent to 

E M (A n (C K ,W7„)) < (n + l)l s l2-" a ' =: A„ (37) 

with A„(C 7r , W™„ ) as the respective average error probability for K — tt and it 
holds for all s" G 5". Thus we have shown that 



C" := {(n-^Xji^n-^Dj)) : j G [J„],Z G [L n ],n G 7T„, M } 



(38) 



is a (n, J n , II n , pi) random code for the AVC channel W n = {W s n : s n € S n } 
with the mean average error probability E^(X n (C K , W£k)) upper bounded by A„ 
as in p7]> . 

Now it is easily seen that 

p C jU(j,z n ) = -IJ-^y"^-!^)^-!^)) = Pjz> . (39) 



Actually, it still holds that 
V C jz 



' & z ") = h E p c jz~, 0'. * n ) = ■ (4°) 

71.1 r ^ o* q 



n! 



With (|39|) and the representation of the mutual information by the information 
divergence we obtain from (|33|) 



%{D{pTz % I |pj ® p|n )) = -7 D (pSz». I IPJ ® Pi» ) 

/ l I Z J Q Q "a 



n! 

7rei7„ 



(41) 



Thus we have constructed a random (n,J n ,r,p) code C* an with mean average 
error probability bounded for all s n £ 5" as in (I3T1) and which fulfills the strong 
secrecy criterion almost surely, provided that there exist a best channel to the 
eavesdropper. By the construction of the random code it follows that the secrecy 
rates given by (f3"2"j) for the compound wiretap channel W achieved by the deter- 
ministic code Cyy are achievable secrecy rates for the AVWC 20 with random 
code C^ an . That is, we have shown that all rates Rs with 

R s < max ( min I(p,W a ) - max I(p,V„)) . (42) 
per{A) qzV(S) q qev(s) q 

are achievable secrecy rates of the arbitrarily varying wiretap channel AVWC 
with random code C an . □ 



3.3 Deterministic Code Construction 

Because the code C 77 that is used for the transmission of a single message is 
subjected to a random selection, reliable transmission can only be guaranteed if 
the outcome of the random experiment can be shared by both the transmitter 
and the receiver. One way to inform the receiver about the code that is chosen is 
to add a short prefix to the actual codeword. Provided that the number of codes 
is small enough, the transmission of these additional prefixes causes no essential 
loss in rate. In the following we use the elimination technique by Ahlswede [2] 
which has introduced the above approach to derive deterministic codes from ran- 
dom codes for determining capacity of arbitrarily varying channels. Temporarily 
we drop the requirement of a best channel to the eavesdropper and state the 
following theorem. 



Theorem 3.10. 1. Assume that for the AVWCW it holds that Cs, ran (2H) > 0. 
Then the secrecy capacity Cs(2U) equals its random code secrecy capacity 

Os,ran(2U), 

Cs(2B) = C s . ran (2B), (43) 

if and only if the channel to the legitimate receiver is non-symmetrisable. 
2- //Cs,ran(2U) = it always holds that C s (%0) = 0. 

First, if the channel to the legitimate receiver is symmetrisable then the de- 
terministic code capacity of the channel to the legitimate receiver equals zero 
by Theorem 13.61 and no reliable transmission of messages is possible. Hence the 
deterministic code secrecy capacity of the arbitrarily varying wiretap channel 
also equals zero although the random code secrecy capacity could be greater 
than zero. So we can restrict to the case in which the channel to the legitimate 
receiver is non-symmetrisable. If Cs(2U) = Cs jran (2H) > 0, then the channel 
to the legitimate receiver must be nonsymmetrisable. For the other direction, 
because the secrecy capacity of the AVWC 20 cannot be greater than the ran- 
dom code secrecy capacity it suffices to show that C({W s n}) > implies that 
Cs(22J) > C , 5 iran (2B). Here C({W S «}) denotes the capacity of the arbitrarily 
varying channels to the legitimate receiver without secrecy. The proof is given 
in the two paragraphs Random code reduction and Elimination of randomness. 



Random Code Reduction We first reduce the random code C ran to a new ran- 
dom code selecting only a small number of deterministic codes from the former, 
and averaging over this codes gives a new random code with a constant small 
mean average error probability, which additionally fulfills the secrecy criterion. 

Lemma 3.11. (Random Code Reduction) Let C(Z) be a random code for the 
AVWC 2U consisting of a family {C(7)} 7 <=r of wiretap codes where 7 is chosen 
according to the distribution /i of Z. Then let 

e(C™ n ) = maxE„e(s n |C(Z)) < A„ and, maxEJipj, V s n;C(Z)) < e' n . 

(44) 

Then for any e and K satisfying 

e>4max{A n ,4} and K> 2ul ° g ^ (1 + nlog 151) (45) 

e 

there exist K deterministic codes Ci, i = 1, . . . , K chosen from the random code 
by random selection such that 

K K 

-J2e(s n \C t )<e and - £ I( Pj , V s n ; d) < e (46) 

i=l i=l 



for all s"eS". 



Proof. The proof is analogue to the proof of Lemma 6.8 [TO], where a similar 
assertion in terms of the maximal probability of error for single user AVCs with- 
out secrecy criterion is established. Cf. also [2]. Let Z be the random variable 
distributed according to \x on r for the (n, J„, r, /x) random code. Now consider 
K independent repetitions of the random experiment of code selections accord- 
ing to fi and call the according random variables Z^ i S {1, . . . , K}. Then for 
any s n e S n it holds that 

K K 

Pr{-^$>( S "|C(^))>e ° r K^ I{pj ' Vsn]C{Zi)) - e ] 

i=l i=l 
K 



r \- e{s n \C{Zj)) Ke y 



< Pr<| 

^—^ n log \A\ n 

+ l ep ^ nloeUI - eXP nlo E Ul/' 



and by Markov's inequality 



K - A' 



Pr{^Ee( S "|C(Z0)> £ or 1 7 S «;C(^)) > e} 

i=l i=l 

<exp( - — — — lEexpV 1 ' , ^ 
V nlog L4 / ■f-' n tog A 



Ke K 

<-^wT4T) Eexp ^ 



7i log I A|/ 4^ nlog|A 



Now because of the independency of the random variables Zi and because all Zi 
are distributed as Z and we have expi < 1 + t, for < t < 1 (exp to the base 
2), we can give the following upper bounds 

( Eexp =^)%( 1+E £(i^)%( 1 + _=^_)' f (47 ) 
V nlogU / V n log LA / V nlog LA / 



and 



(Ee^tepf <( 1+E fcl^2f <(l 
\ n log LA / ~ V n log LA / ~ V 



c ' \ K 



7ll0g|A| 



(48) 



Hence we obtain for any s n 6 S 

K 



K 1 K 



< exp — A 



nlog |A| 



log(l 



exp 



i=i 

Ar, 



nlog \A\ 
(-K( 



< 2 exp 



-K 



nlog \ A\ 



log(l + max{ 



nlog |A| 

A,, 



log(l 



nlog \A\ ' nlog |A 



n log |A| 



Then 



K K 

Pr {i?^ e(s " |C(Zl)) " 6 and -^7^,^;^)) < e,Vs" G 5"} 



> l-2|S| n eocp 



A' 



vnlog |A| 

which is strictly positive, if we choose 



log(l + max{ 



e > 2n log \A\ log(l + max{ 



Ar. 



nlog |A| ' nlog \ A 



}) 



}) 



nlog|^4| nlog|^4| 



and 



A> ^M](n + n 2 log |S|) 



Now because for < t < 1 and log to the base 2 it holds that 

t < log(l + £) < 2t , 

we increase the lower bound for choosing e if 

e > 4max{A„, eJJ . 



(49) 



(50) 



and with (|50|) the assertion of (j49|) still holds. Hence, we have shown that there 
exist A realisations d :— C(Zi = 7.;), 7,- G -T, i G {1, . . . , A} of the random code, 
which build a new reduced random code with uniform distribution on these codes 
with mean average error probability and mean secrecy criterion fulfilled by (|46[) . 

□ 

Now, if we assume that the channel to the legitimate receiver is non- 
symmctrisable, which means that C({W s n}) > 0, and that there exist a random 
code C™ 11 that achieves the random code capacity Cs jran (2B) > 0, then there 
exist a sequence of random (n, J n ) codes with 

1 J„ 

lim max—EE E ' (i D ]f = , 



j=i 7 gri"gA" 



liminf - log J n -> C* s . ran (2ir) > 0, 

n— J-oo fi 

and 

lim max £ I(py, V^;C{l))Kl) = 0- (51) 

Then on account of the random code reduction lemma there exist a sequence of 
random (n, J n ) codes consisting only of n 3 deterministic codes (cf. (H51 ) chosen 
from the former random code, and it holds for any e > and sufficiently large n 
that 

1 J n « n 3 

™ a £ rElEE E\ X n \j)WZ ((D)r\x n ) < e (52) 
j=i i=i i»gi" 

and 

n 3 

™« -3£ J (pj;^; c 0<c (53) 

»=i 

where Cj = {(Ej,Dj),j £ J"„}, i = 1, . . . , n 3 , and -E 1 is the stochastic encoder of 
the deterministic wiretap code. Then the reduced random code consists of the 
family of codes {Ci}i£{i,...,n 3 } together with the uniform distribution //(£) = ^ 
for all i £ {1, . . ., n 3 }. 



Elimination of randomness (Cf. Theorem 6.11 in [TO] ) 

Now if there exist a deterministic code and C({Ws»}) > then there exist a 
code 

{x^,Fi c£ fc " :i = l,...n 3 } (54) 

where x kn is chosen according to an encoding function fi : {1, . . . ,rt 3 } — > A fe ™ 
with ^ -4 as n — ► oo with error probability 

1 " 3 

-j^^fri^/)^ (55) 

1 

for any e > and sufficiently large n (cf. (|52p) for all s kn £ S n . If we now 
compose a new deterministic code for the AVWC 2B by prefixing the codewords 
of each 

{ft^Fi x D) : i = 1, . . . , n 3 ,j £ [J n ]} =: C , (56) 

the decoder is informed of which encoder E l is in use for the actual message j if 
he identifies the prefix correctly. Note that for the transmission of the prefix only 
the reliability is of interest, because it contains no information about the message 
j £ Jn to be sent. Now the new codewords has a length of k„ + n, transmit a 
message from {1, . . . ,n 3 } x J n , where the channel which is determined by the 



state sequence s kn+n £ S kn+n yields an average error probability of 

a„(c, < -L- e E ( A * + ^ (0) 

" J " <=li6[J„] 
1 n 3 n 3 

<-3E A * + ^E e «(^ c ^ 2e - 



(57) 



Here, for each s k ™ 6 S 1 " Ai means the error probability for transmitting i from 
{1, . . . , n 3 } encoded in x kn by W fc ™ followed by the transmission of j, where the 
codeword is chosen according to the stochastic encoder E l - , over the last n chan- 
nel realisations determined by s n with error probability Xj(i). This construction 
is possible due to the memorylessness of the channel. 

Now if we turn to the security part of the transmission problem it is easily 
seen that 



p L JZ , n+n (J,^" + ") 



1 1 

J n n 3 



(58) 



where z kn are the first k n components of z kn+n . With ([58)) and the representation 
of the mutual information by the information divergence we obtain that 



D(p c kn+n \\pj®p C 7kn+n ) 



1 ' 

i=l 



Ci 

JZ" 



c, 

JZ" 



1 



(59) 



^ n n 
= IsE M^» n \\PJ ® ) = IaE '(PJ> ^ ; Ci) < e 

t=l i=l 

for all s™ <E 5™ and n £ N sufficiently large, where the first inequality follows 
because for two probability distributions p, q the relative entropy D{p\\q) is a 
convex function in the pair (p, q) and the last inequality follows by the random 
code reduction lemma. 

Because ^ — > as n — > oo 

lim - — - — log(n 3 J„) = lim (-log J„ + -log(n 3 )) = lim - log J„ , (60) 

n— >oo K n -\- n n—>oo n n n— >oo n 

C n is a deterministic (n, J n ) code which achieves the same rates as the random 
code C^ an and so the random code capacity Cs, ran as given in (fSTj) . provided that 
the channel to the legitimate receiver is non-symmetrisable. 



Thus, with {1, . . . , J n } as the message set, C n is a deterministic (n + o(n), n 3 ■ 
J n ) code with average error probability bounded for all s kn+n £ S n+n as in (|57l) 
and which fulhlls the strong secrecy criterion as in (|5§)) . and which achieves the 
random code secrecy capacity Cs iran of the arbitrarily varying wiretap channels 
AVWC W which implies that Cs = Cs !ran . This concludes the proof. 

Note that in the case in which the channel to the legitimate receiver is non- 
symmetrisable and we know that the deterministic code secrecy capacity Cs(2B) 
equals zero we can conclude that the random code secrecy capacity Cs jran (2B) 
equals zero. As a consequence of the theorem we can state the following assertion. 



Corollary 3.12. The deterministic code secrecy capacity of the arbitrarily vary- 
ing wiretap channel 2B, provided that there exists a best channel to the eaves- 
dropper and under the assumption that the channel to the legitimate receiver is 
non-symmetrisable, is lower bounded by 

C S (W)> max ( min I(p, W„) - max I(p,V a )) . 

pdV(A) qdV(S) q£V(S) 

Proof. Combine the assertions of Proposition 13.91 and Theorem 13.101 □ 



3.4 Upper bound on the capacity of the AVWC 217 and a 
multi-letter coding theorem 

In this section we give an upper bound on the secrecy capacity of the AVWC 
2U which corresponds to the bound for the compound wiretap channel built by 
the same family of channels. In addition we give the proof of the multi-letter 
converse of the AVWC 2U. 

Theorem 3.13. The secrecy capacity of the arbitrarily varying wiretap channel 
AVWC 2H is upper bounded, 

C<?(2U) < min max (I(U,Y„) - I(U, Z„)) . (61) 



Proof. By Lemma 13.71 the capacity of the AVWC 2B equals the capacity of the 
AVWC W. Obviously, the set W = {{Wf n ,V® n ) : q € V{S)} which describes 
a compound wiretap channel is a subset of 2S = {(W? , V- 1 ) : q £ P(S n ),q = 
n"=i Qi}- Now, because we can upper bound the secrecy capacity of the AVWC 
2U by the secrecy capacity of the worst wiretap channel in the family 2U , to- 
gether with the foregoing we can upper bound it by the capacity of the worst 
channel of the compound channel W. Hence, 

C S (W) = C S (W) < inf C S ((W?,V?)) 

q 

< to£C s ((W?> K)) = '*&Cs(W v V q ) , 
q H H q 

The minimum is attained because of the continuity of C's(W q , V q ) on the compact 
set W. □ 



Remark 3.14- Consider the special case of an AVWC 233 = {(W s n,V r n) : 
s n £ S n , r n £ S*2 }, where both the state of the main channel s £ Si and 
the state of the eavesdropper's channel r £ S% in every time step can be 
chosen independently. In addition let us assume that there exist a channel 
W q * £ {W qi : qi £ V(Si)}, which is a degraded version of all other chan- 
nels from {W qi : q\ £ V(Si)}, and a best channel to the eavesdropper V q * from 
the set {V q2 : 172 G ^(^2)} (c£ Definition 13 . 8[) . Then in accordance with Sec- 
tion 3.5 of [5] the lower bound on the secrecy capacity given in Corollary 13. 121 
matches the upper bound from Theorem 13. 131 Thus we can conclude that under 
the assumption, that the channel to legitimate receiver is non-symmetrisable, 
the capacity of the AVWC 2U is given by 

C S (W) = ™* A) (I(P, Wq*) - I( P , V q *)) . 

Now in addition to Theorem 13.131 we give a multi-letter formula of the upper 
bound of the secrecy rates. Therefore we need the following lemma used in 
analogy to Lemma 3.7 in [8]. 

Lemma 3.15. For the arbitrarily varying wiretap channel AVWC W n the limit 
lim - max ( inf 1(17, Y?)- sup I(U,Z%)) 

exists. 

The proof is carried out in analogy to Lemma 3.7 in [5] and therefore omitted. 

Theorem 3.16. The secrecy capacity of the arbitrarily varying wiretap channel 
AVWC 2U is upper bounded by 

C S (2B) < lim - max ( inf I(U,Y, n ) - sup I(U,Z%)) , (62) 

where q = n"=i<?i> 1i e 'P(S) an d Y^Z 1 - are the outputs of the channels W~ l 
and V- 1 respective. 

Proof. Let (C„) ne pj be any sequence of (n, J n ) codes such that with 
i h 

SU P tY. Y. E (x n \3W*{D c Ax n ) =: £l> „ and, sup I(J, Z" n ) = : e 2 ,n 

it holds that limn^oo £i jTl — and linin^oo £2,n, where J denotes the random 
variable which is uniformly distributed on the message set J n . Because of Lemma 
13.71 we obtain that for the same sequences of (n, J n ) codes 



1 Jn 

lim sup — V V E(x n \j)Wf(D?\x n ) = lim e ln = (63) 



and 

lim sup /(J, Z\) = lim e 2 ,„ = . (64) 



n—toc 



q£V(S" 



Now let us denote another random variable by J with values in J n determined 
by the Markov chain J — > X n — > Y- 1 — > J, where the first transition is governed 
by E, the second by W?, and the last by the decoding rule. Now the proof is 
analogue to the proof of Proposition 3.8 in |S]. For any q £ V(S n ) we have from 
data processing and Fano's inequality 

(1 -£!,„) log J„ <I(J,Y?) + 1. 

We then use the validity of the secrecy criterion (|64p to derive 

(1 - ei,„) log J n < I(J, Y?) - sup I(J, Z$) + s 2 ,„ + 1 

<? 

for any q G V(S n ). Since the LHS does not depend on q we end in 

(1 -ei, n ) log J n < max (inf I{U, Y?) - sup 1(1/, Z™)) + e 2 . n + 1 . 

U->X n ^YPZ? q q 

Dividing by n £ N and taking lim sup concludes the proof. □ 

Now if we consider the set W = {(W® n ,F®™) : q € V(S)} as a subset of 
W n = {(W^V? 1 ) : q e T(S n ),q = U?=iQi} and the same sequence (C„)„ eN of 
(n, J„) codes for the AVWC 2U for which (j6"31 and holds, we can conclude 
that 

1 ^ 

lim SU p V" S(a; n |j)W® n (^|a; n ) < hm £i „ (65) 

and 

lim sup I(J, Zl l ) < lim e 2 „ , (66) 

n— >oo q(='p(S) n—toc ' 

with £i iM and £2,™ as above. Then we can conclude with the same argumentation 
as in the previous proof, 

Corollary 3.17. The secrecy capacity of the arbitrarily varying wiretap channel 
AVWC 2U is upper bounded by 

Cs(2H) < lim - max ( inf I(U,Y?) - sup I(U,Z?)) , 

where q £ V(S) and Y*,Z™ are the outputs of the channels Wf n and V® n 
respective. 

Now, using standard arguments concerning the use of the channels defined by 
Py \u = W q ■ Px\u an d Pz \U — Vq ' Px\u instead of W q and V q and applying 
the assertion of Corollarv l3.12l to the n-fold product of channels W q and V q , we 
are able to give the coding theorem for the multi-letter case of the AVWC with 
a best channel to the eavesdropper. 



Theorem 3.18. Provided that there exist a best channel to the eavesdropper, 
the multi-letter expression for the secrecy capacity Cs{%B) of the AVWC 2JJ is 
given by 



if the channel to the legitimate receiver is non-symmetrisable, and is zero other- 
wise. 

Acknowledgment 

Support by the Deutsche Forschungsgemeinschaft (DFG) via projects BO 
1734/16-1, BO 1734/20-1, and by the Bundesministerium fur Bildung und 
Forschung (BMBF) via grant 01BQ1050 is gratefully acknowledged. 

References 

1. Ahlswede, R.: A note on the existence of the weak capacity for channels with 
arbitrarily varying channel probability functions and its relation to shannon's zero 
error capacity. The Annals of Mathematical Statistics 41(3), 1027-1033 (1970) 

2. Ahlswede, R.: Elimination of correlation in random codes for arbitrarily vary- 
ing channels. Zeitschrift fur Wahrscheinlichkeitstheorie und verwandte Gebiete 44, 
159-175 (1978) 

3. Ahlswede, R., Csiszar, I.: Common randomness in information theory and 
cryptography-part I: Secret sharing. IEEE Transactions on Information Theory 
39(4), 1121-11132 (July 1993) 

4. Ahlswede, R., Csiszar, I.: Common randomness in information theory and 
cryptography-part ii: Cr capacity. IEEE Transactions on Information Theory 44(1), 
225-240 (January 1998) 

5. Ahlswede, R., Wolfowitz, J.: The capacity of a channel with arbitrarily varying 
channel probability functions and binary output alphabet. Z. Wahrscheinlichkeit- 
stheorie verw. Gebiete 15, 186-194 (1970) 

6. Ahlswede, R.: Arbitrarily varying channels with states sequence known to the 
sender. IEEE Transactions on Information Theory 32(5), 621-629 (Sept 1986) 

7. Bjelacovic, I., Boche, H., Sommerfeld, J.: Capacity results for compound wiretap 
channels. Proc. IEEE Information Theory Workshop pp. 60-64 (2011) 

8. Bjelacovic, I., Boche, H., Sommerfeld, J.: Secrecy results for compound wiretap 
channels (2011), http://arxiv.org/abs/1106.2013vl, submitted to Problems of 
Information Transmission 

9. Bloch, M., Laneman, J.: On the secrecy capacity of arbitrary wiretap channel. 
Forty-Sixth Annual Allerton Conference, Allerton House, Illinois, USA (Sep 2008) 

10. Csiszar, I., Korner, J.: Information Theory: Coding Theorems for Discrete Memo- 
ryless Systems. Akademiai Kiado (1981) 

11. Csiszar, I., Narayan, P.: The capacity of the arbitrarily varying channel revisited: 
Positivity, constraints. IEEE Transactions on Information Theory 34(2), 181-193 
(1988) 




12. Ericson, T.: Exponential error bounds for random codes in the arbitrarily varying 
channel. IEEE Transactions on Information Theory 31(1), 42-48 (1985) 

13. Liang, Y., Kramer, G., Poor, H., Shamai, S.: Compound Wiretap Channels. 
EURASIP Journal on Wireless Communications and Networking (2008) 

14. MolavianJazi, E.: Secure Communications over Arbitrarily Varying Wiretap Chan- 
nels. Master's thesis, Graduate School of the University of Notre Dame (2009) 

15. Shannon, C: The zero error capacity of a noisy channel. IRE Trans. Information 
Theory IT-2 pp. 8-19 (1956) 

16. Wyrembelski, R.F., Bjelakovic, I., Oechtering, T.J., Boche, H.: Optimal coding 
strategies for bidirectional broadcast channels under channel uncertainty. IEEE 
Transactions on Communications 58(10), 2984-2994 (October 2010) 



